roles/acme/handlers/main.yaml

@@ -1,9 +1,7 @@
----
-
 - name: update_contact_info
   ansible.builtin.command:
     cmd: dehydrated --account
 
-- name: run dehydrated
+- name: query_certificates
   ansible.builtin.command:
     cmd: dehydrated --cron

roles/acme/tasks/main.yaml

@@ -1,46 +1,82 @@
 ---
+- ansible.builtin.import_tasks:
+    file: remove_conflicting.yaml
+  tags: [ never, acme_remove_conflicting ]
 
 - name: Install Dehydrated
+  tags: [ acme, acme_install ]
+  block:
+    - name: Install dependencies
       ansible.builtin.apt:
+        name: ssl-cert
         state: present
-    pkg:
-      - dehydrated
-  tags:
-    - acme
 
-- name: Create Nginx snippet snippets dir
+    - name: Install Dehydrated
-  ansible.builtin.file:
+      ansible.builtin.apt:
-    state: "directory"
+        name: dehydrated
-    path: "/etc/nginx/snippets"
+        state: present
-    owner: "root"
-    group: "root"
-    mode: "0755"
 
-- name: Template dehydrated configfiles
+    - name: Install config file
       ansible.builtin.template:
-    src: "{{ item.src }}"
+        src: config.sh
-    dest: "{{ item.dest }}"
+        dest: /etc/dehydrated/conf.d/ansible.sh
-    owner: "{{ item.owner | default('root') }}"
+        owner: root
-    group: "{{ item.group | default('root') }}"
+        group: root
-    mode: "{{ item.mode | default('0640') }}"
+        mode: 0755
-    notify: "{{ item.notify | default([]) }}"
+      notify: update_contact_info
-  with_items:
-    - { src: "config.sh",          dest: "/etc/dehydrated/conf.d/ansible.sh", mode: '0755' }
-    - { src: "deploy.sh",          dest: "/etc/dehydrated/conf.d/deploy.sh",  mode: '0755' }
-    - { src: "cron",               dest: "/etc/cron.d/dehydrated" }
-    - { src: "nginx-snippet.conf", dest: "/etc/nginx/snippets/acme.conf" }
-    - { src: "domains.txt",        dest: "/etc/dehydrated/domains.txt", notify: "run dehydrated" }
 
-- name: Register account
+    - name: Install deploy hook
+      ansible.builtin.template:
+        src: deploy.sh
+        dest: /etc/dehydrated/conf.d/deploy.sh
+        owner: root
+        group: root
+        mode: 0755
+
+    - name: Install cronjob
+      ansible.builtin.template:
+        src: cron
+        dest: /etc/cron.d/dehydrated
+        owner: root
+        group: root
+        mode: 0644
+
+    - name: Create Nginx snippet snippets dir
+      ansible.builtin.file:
+        state: directory
+        path: /etc/nginx/snippets
+        owner: root
+        group: root
+        mode: 0755
+
+    - name: Install Nginx snippet
+      ansible.builtin.template:
+        src: nginx-snippet.conf
+        dest: /etc/nginx/snippets/acme.conf
+        owner: root
+        group: root
+        mode: 0644
+
+    - name: Register account
       ansible.builtin.command:
-  args:
         cmd: dehydrated --register --accept-terms
+      args:
         creates: /var/lib/dehydrated/accounts
 
-- name: Symlink SAN domains
+- tags: [ acme, acme_certs ]
+  block:
+    - name: Configure certificates
+      ansible.builtin.template:
+        src: domains.txt
+        dest: /etc/dehydrated/domains.txt
+        owner: root
+        group: root
+        mode: 0644
+      notify: query_certificates
+
+    - name: Symlink SAN domains
       ansible.builtin.include_tasks:
         file: san_domains_loop.yaml
       loop: "{{ acme_san_domains|default([]) }}"
       loop_control:
         loop_var: domains
-

roles/acme/tasks/remove_conflicting.yaml

@@ -1,4 +1,9 @@
 ---
+- name: Remove certbot from apt
+  ansible.builtin.apt:
+    name: [ letsencrypt, certbot ]
+    state: absent
+    autoremove: yes
 
 - name: Remove variable directories
   ansible.builtin.file:

roles/acme/tasks/san_domains_loop.yaml

@@ -1,5 +1,4 @@
 ---
-
 - ansible.builtin.stat:
     path: "/var/lib/dehydrated/certs/{{ domains[0] }}"
   register: cert_stat

roles/acme/templates/config.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 
-# {{ ansible_managed }}
+# Managed by Ansible
 
 CONTACT_EMAIL={{ notify_email }}

roles/acme/templates/cron

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# Managed by Ansible
 
 SHELL=/bin/sh
 PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

roles/acme/templates/deploy.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 
-# {{ ansible_managed }}
+# Managed by Ansible
 
 systemctl reload nginx.service

roles/acme/templates/domains.txt

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# Managed by Ansible
 
 {% for domain in acme_domains|default([]) %}
 {{ domain }}

roles/acme/templates/nginx-snippet.conf

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# Managed by Ansible
 
 location /.well-known/acme-challenge {
 	allow all;

roles/common/defaults/main.yaml

@@ -17,5 +17,3 @@ node_exporter: true
 
 debian_packages_unwanted:
   - netcat-traditional
-  - letsencrypt
-  - certbot